Fake WatchGuard VPN site steals admin credentials while delivering real software
Security investigators identified a fraudulent website that collected administrator login details from users searching for a legitimate WatchGuard VPN download.
Investigation into suspicious activity
Huntress security investigators traced the attack after detecting unusual behavior involving an administrator at a managed service provider. The user searched Bing for a WatchGuard VPN client and clicked a link to a deceptive webpage designed to look like the official download page.
How the fraud worked
The fraudulent domain watchguard-vpn[.]net displayed a form asking for server addresses, usernames, and passwords required by the genuine client. Submitting this information sent the credentials to attackers while the site simultaneously provided the authentic installation package.
Attacker collection methods
Experts claim the fraudulent website rejected initial submissions to trick victims into entering their details a second time. This tactic allowed attackers to harvest connection information before delivering the legitimate software without raising suspicion.
Reported by one outlet
Only one outlet has published this. Nothing here has been checked against a second report, so read it as that outlet's account and follow the link below for the original.
Reported by
1 independent outlet. Headline as published. Links open the original report.